According to the EOSJS readme:
Using the JsSignatureProvider in the browser is not secure and should only be used for development purposes. Use a secure vault outside of the context of the webpage to ensure security when signing transactions in production
const defaultPrivateKey = "5JtUScZK2XEp3g9gh7F8bwtPTRAkASmNrrftmx4AxDKD5K4zDnr"; // bob const signatureProvider = new JsSignatureProvider([defaultPrivateKey]);
According to this description,
JsSignatureProvider is not safe to use in combination with .env variables. What is the safe way to programmatically send EOSIO tokens using EOSJS?